A critical security flaw dubbed ‘CopyEscape’ has been identified in Docker, posing a significant threat to host systems. This vulnerability, tracked as CVE-2026-17106, enables malicious containers to overwrite host files and potentially gain root-level access, particularly on Linux systems.
Understanding the CopyEscape Vulnerability
Uncovered by the Imperva Red Team, the vulnerability resides in the docker cp command. This command is integral to Docker’s operations, especially in AI-agent workflows within Docker Sandboxes. The flaw allows hostile containers to escape their confines, manipulate host files, and execute code with root privileges under certain conditions.
The core of the issue lies in Docker’s archive handling mechanism. When executing a command like docker cp container:/path/to/file.txt ./file.txt, Docker doesn’t directly copy the file. Instead, it creates a tar archive of the file system path, which the Docker CLI extracts on the host. This process relies on assumptions that the archive is consistent and the extracted files remain within the user-defined destination.
Exploitation Techniques and Risks
Researchers found a way to disrupt these assumptions using a combination of a filesystem race condition and a flawed symlink verification. Attackers can manipulate files during the archive walk by swapping directories, leading Docker to record a directory and replace it with a symlink. This symlink then redirects the file placement outside the intended directory, such as into critical system paths like /usr/bin.
Such vulnerabilities threaten the security of CI/CD pipelines, developer workstations, and incident-response workflows. In particular, Linux systems running docker cp with elevated privileges are vulnerable to severe breaches, as attackers could replace system binaries, resulting in immediate root control.
Mitigation and Future Outlook
To mitigate these risks, Docker has released patches for Docker Engine and CLI 29.7.2, Docker Desktop 4.86.0, and Docker Sandboxes 0.38.0. Organizations are advised to update their systems promptly. Those unable to upgrade should avoid using docker cp with untrusted containers, halt containers before file transfers, and refrain from using sudo with docker cp.
This incident underscores the necessity for robust security measures during archive extraction, as path-checking procedures alone cannot safeguard against symlink and concurrent file modifications. The security community continues to learn from such vulnerabilities, reinforcing the need for vigilant practices and system updates.
For more insights into securing Docker environments and other cybersecurity challenges, join an upcoming webinar hosted by Elastic & UnderDefense. Learn how to integrate AI visibility and response strategies into your security model. Register Now.
